20643 matches found
PT-2026-95488
Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.7 Description An issue exists in the ForbiddenListSpec.ExactMatch function within pkg/api/forbidden list.go where denied metadata keys are sorted case-insensitively but then searched using a byte-order binary...
JFrog Artifactory < 7.146.35 Multiple Vulnerabilities
According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.35. It is, therefore, affected by the following vulnerabilities. - An authentication weakness that, under default configuration, may allow an unauthenticated attacker wit...
Linux Distros Unpatched Vulnerability : CVE-2026-77408
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to...
PYSEC-2026-3996
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...
CVE-2026-54734
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can...
CVE-2026-54507
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...
EUVD-2026-82581
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can...
EUVD-2026-82567
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...
CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...
CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...
GHSA-67C9-F6V2-QV86 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
Summary Steeltoe's Consul discovery client parses the secure metadata field on each registered service instance using bool.Parse, which throws on any value other than true or false. A single service instance registered with a malformed secure value for example yes or 1 aborts construction of the...
Improper Handling of Exceptional Conditions
Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions due to the ConsulServiceInstance parsing of Consul service metadata in src/Discovery/src/Consul/ConsulServiceInstance.cs. An attacker can abort service instance lookup by registering a service...
Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
Summary Steeltoe's Consul discovery client parses the secure metadata field on each registered service instance using bool.Parse, which throws on any value other than true or false. A single service instance registered with a malformed secure value for example yes or 1 aborts construction of the...
CVE-2026-90396
In the Linux kernel, the following vulnerability has been resolved: block: fix dio leak on metadata mapping error A failed integrity mapping holds a dio reference, so we need to go through the full bio ending in case there were previously submitted bio's in the sequence...
DEBIAN-CVE-2026-90396
In the Linux kernel, the following vulnerability has been resolved: block: fix dio leak on metadata mapping error A failed integrity mapping holds a dio reference, so we need to go through the full bio ending in case there were previously submitted bio's in the sequence...
CVE-2026-90086
In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...
Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...
GHSA-R56G-Q4P6-M3P6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...